Names not completely redacted despite "Redact the names of the involved users" is selected
Low
H
HackerOne
Submitted None
Team Summary
Official summary from HackerOne
In the Export PDF function using a limited rollout function (as of writing), @japz found an edge case with the Redact Usernames functionality that names ending with a `.` would not get properly redacted. We accepted and fixed this edge case.
Actions:
Reported by
japz
Vulnerability Details
Technical details and impact analysis
**Summary:**
Hi @security @zerotea,
Hope you are doing well.
Today I have found a special edge case where the names are still visible despite "Redact the names of the involved users" is selected on export as .pdf report. This is similar to the resolved reports #2109009 and #2054222.
But this time, looks like the root cause is coming from a team member that triggers the `agreed on going public` and `report became public` activity on the report but did not leave any single comment on the report, I have found that when the involve user (names) of a team member that did not put any comments but he is the one who agreed to disclose this report, then his name will be visible on the report despite the `"Redact the names of the involved users"` is selected
Please note that just observed that today because of this disclosed report today from @linkedin:
Disclosed Rerport: [Improper access control on Linkedin Page](https://hackerone.com/reports/1587246)
While reading that report, i tried to export that as .pdf and I selected the option `Redact the names of the involved users`, then I saw that the name of the team member who `agreed to disclose report report` is still visible on the activity.
__Name:__ `Emmanuel L.`
### Steps To Reproduce
1. Go to this disclosed report from LinkedIn: https://hackerone.com/reports/1587246
2. Export the report as .pdf , make sure to select the `Redact the names of the involved users`
3. Check the report output and you will see below acitivity
`Emmanuel L. 2023-08-24 02:42 report became public Public`
`Emmanuel L. 2023-08-24 02:42 agreed on going public Public`
For easier step to reproduce, you can just visit this https://hackerone.com/reports/1587246.pdf?redact_usernames=true&pdf_type=reporter
{F2632963}
## Impact
Disclosing the supposed to be redacted data, sensitive information disclosure.
Let me know if you have any question
Regards,
@japz
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$500.00
Submitted
Weakness
Information Disclosure